WHAT IS CLAIMED IS: 



0 

drivers, comprising. 



In a computer system, a method for monito/ing 



receiving a request from a driver; 
determining that the driver is to be nt&nitored; 
re-vectoring the request to a driver verifier; and 
taking action in the driver verifier to monitor the 
driver. 

2. The method of claiiti/l wherein receiving a request 
from a driver includes receiving a function call in a kernel 
component of an operating system. 

3. The method!' of claim 1 wherein determining that the 
driver is to be itjonitored includes checking a registry 
setting. 



4. vThe method of claim 1 wherein the request from the 
driver i/ficludes a memory allocation request, and wherein 
takin/ action in the driver verifier to monitor the driver 
inc/udes allocating memory space thereto from a special pool 
oz memory. 
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5. The method of claim 1 wherein the request from the 

/ 

driver includes a memory allocation request, and wherein 
taking action in the driver verifier to monitor the ciriver 
includes marking memory bounding the memory space bo detect 
improper access of the memory bounding the memor/ space. 

6. The method of claim 1 wherein the /request from the 
driver includes a memory deallocation request, and wherein 
taking action in the driver verifier toAionitor the driver 
includes marking deallocated memory space to detect improper 
access of the deallocated memory s^ace. 

7. The method of claim/l wherein taking action in the 
driver verifier to monitor ythe driver includes maintaining 
allocation information ir/ at least one data structure 
associated with the dr/ver. 

8. The method of claim 7 wherein the request from the 
driver includes/a memory allocation request, and wherein 
maintaining a/location information includes adding data 
correspondi/fg to the allocation request to the data structure. 
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9. The method of claim 7 wherein the request from the 
driver includes a memory deallocation request, and wherein 
maintaining allocation information includes removing yuata 
corresponding to the allocation request from the d/ta 
structure. / 

10. The method of claim 7 further comprising providing 
the allocation information to a user interface. 

11. The method of claim 1 wherein taking action in the 
driver verifier to monitor the drwer includes validating call 
parameters . / 

12. The method of cladm 1 wherein taking action in the 
driver verifier to monitor the driver includes checking for 
resources allocated to/the driver at driver unload. 

13. The metfeK)d of claim 1 wherein taking action in the 
driver verifier/ to monitor the driver includes simulating a 
low resource /condition. 



- 50 - 



# • 

14. The method of claim 13 wherein .simulating the low 
resource condition includes failing requests for memory pool 
allocation. X 

15. The method of cl^im 13 wherein simulating the low 
resource condition inc2^udes invalidating driver code and data. 

16. The Htfethod of claim 1 wherein taking action in the 
driver verifier to monitor the driver includes checking for 
timers/in deallocated pooled memory. 

17. The metnod of claim 1 wherein taking action in the 
driver verifier inclSades monitoring the use of an I/O request 
packet by the driver. \ 

18. The method cfcf ol\ini 1 wherein taking action in the 
driver verifier includes allWating an I/O request packet from 
a special pool. \ 

19. The method of claim 1 wtterein taking action in the 
driver verifier comprises, monitoring I/O requests traveling 
in the system. \ 
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20. Vhe method of claim 1 wherein taking action in the 
driver verifier comprises, checking for misformed and 
mishandled I/O requests. 

21. The meVhod of claim 1 wherein taking action in the 
driver verifier comprises, modifying I/O requests to 
facilitate detection of mishandled I/O requests. 

22. The method c^f^-eiaim 21 further comprising, detecting 
a mishandled I/O re^es\ tha^ is a stale I/O request. 

23. The method of claam 21 further comprising, detecting 
a mishandled I/O request thaK is an already completed I/O 
request. \ 

24. The method of claim 21 further comprising, 
completing an I/O request in a resDorictive environment to 
detect mishandling of I/O requests. \ 

25. The method of claim 21 furthers comprising, detecting 
a mishandled I/O request that returns inconsistent results. 
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26. The method of claim 21 further comprising, detecting 
a mishandled I/O :^qviest that returns uninitialized results. 

^ 27. A computer-readable medium having compute- 
executable instructions, comprising: 

receiving a request from a component to/ allocation of 
memory space; 

determining a location of memory y^pace to allocate; 

restricting access to areas boimding the location; 

allocating the memory space and 

monitoring the areas bounding the location for an access 
violation. 

28. The computer-readable mediiam of claim 27 having 
further computer-esrecutable instructions, comprising, 
detecting an acoess violation. 

29. Tne computer-readable medium of claim 27 having 
further ycomputer-executable instructions, comprising 

receiving a request from the component for deallocation 
of/the memory space; 

restricting access to deallocated memory space; and 
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monitoring the deallocated memory space for an access 
violation. / 

30. The computer-readable medium of claim 2^ having 
further computer-executable instructions, comprising, 
detecting an access violation in the deallcMzfated memory space. 

31. A computer-readable medium having computer- 
executable instructions, comprising/ 

receiving a plurality of requests from a component for 
allocation of various distinct sets memory; 
allocating the memory; / 

tracking the space allocated to the component on each 
request; / 

receiving requests for deallocation of at least one of 
the sets of memory allocated to the component; 

tracking the/space deallocated in each received 
deallocation request; and 

determipiing from the tracking whether space remains 
allocated yfco the driver at a time when the driver should have 
no spacer allocated thereto. 



32. A computer-readable medium having computer- 
executable instructions, comprising: / 

receiving information corresponding to a/driver unload; 
determining whether resources remain associated with the 
driver; / 
and if so, generating an error. / 

33. The computer-readable mefaium of claim 32 wherein 
determining whether resources remain associated with the 
driver includes examining lis/s maintained by a system kernel. 

34. The computer-readable medium of claim 32 wherein 
determining whether rescJurces remain associated with the 
driver includes maintafining information tracking memory 
allocated to the driver and deallocated thereby. 

35. A system for monitoring drivers, comprising: 

an operating system component including an interface for 
receiving requests from drivers; 

a re/vectoring component for examining the requests to 
determipie whether requesting drivers are to be monitored; and 

A driver verifier component operably connected to the re- 
ve^toring component, the driver verifier receiving information 
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from the re-vectoring component for a driver tha(£ is to be 
monitored and executing at least one test to inonitor the 
driver. / 

36. The system of claim 35 wherean the operating system 
component comprises a kernel component. 

37. The system of claim 33^ wherein the re-vectoring 
component determines that the/driver is to be monitored based 
on a setting in a registry./ 

38. The system oy claim 37 further comprising a user 
interface for writing/ driver information to the registry. 

39. The sys/tem of claim 35 wherein the request from the 
driver includes/ a memory allocation request, and wherein a 
test by the driver verifier includes allocating memory space 
thereto from a special pool of memory, and marking memory 
bounding /the memory space to detect improper access of the 
memory jSounding the memory space. 

/ 40. The method of claim 35 wherein the request from the 
di/iver includes a memory deallocation request, and wherein a 
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test by the driver verifier includes deallocating the metnory 

/ 

space, and marking the deallocated memory space to detect 
improper access thereof. / 

41. The system of claim 35 wherein a tea(x by the driver 
verifier includes examining resources allooated to the driver. 

42. The system of claim 41 wherein examining resources 
allocated to the driver includes tracking outstanding memory 
allocated to the driver. / 

43. The system of claini 41 wherein examining resources 
allocated to the driver includes reviewing lists maintained by 
the operating system contponent for information therein 
associated with the d/iver. 

44. The me;chod of claim 35 wherein a test performed by 
the driver includes validating call parameters. 

45. / The method of claim 35 wherein a test performed by 
the dr/ver includes failing requests for memory pool 
allegation. 
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46. The method of claim 35 wherein a test performed by 
the driver includes invalidating dpiver code and data. 

47. The method of cla^m 35 wherein a test performed by 
the driver includes checking for timers in deallocated pooled 
memory. 
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